Security Bulletin
Summary
Red Hat OpenShift on IBM Cloud is affected by a Kubernetes security vulnerability that could allow a malicious user to intercept traffic from other pods or nodes in the cluster (CVE-2020-8554)
Vulnerability Details
CVEID: CVE-2020-8554
Description: Kubernetes could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw when using LoadBalancer or ExternalIPs. By using man-in-the-middle attack techniques, an attacker could exploit this vulnerability to patch the status of a LoadBalancer service.
CVSS Base Score: 6.3
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/192721 for more information
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Affected Products and Versions
Red Hat OpenShift on IBM Cloud 3.11
Remediation/Fixes
Workarounds and Mitigations
You can mitigate this vulnerability by using Kubernetes role-based access control (RBAC) to limit the users authorized to create and update Kubernetes services. Red Hat OpenShift on IBM Cloud version 4 clusters only allow a cluster admin to create services with an external IP address. You can further mitigate this vulnerability by controlling network traffic for classic or VPC clusters. Refer to the Kubernetes security advisory CVE-2020-8554: Man in the middle using LoadBalancer or ExternalIPs and Red Hat documentation for CVE-2020-8554 for more information on this vulnerability. Note that Red Hat OpenShift on IBM Cloud does not support configuring the external IP addresses ranges. Refer to the Tigera blog New Vulnerability Exposes Kubernetes to Man-in-the-Middle Attacks: How to Mitigate CVE-2020-8554 for more information on this vulnerability and an overview of how network policies can be used to mitigate this vulnerability. Note that Red Hat OpenShift on IBM Cloud does not support Calico Enterprise.
You can monitor your cluster for external IP usages by running the following command:
kubectl get svc --all-namespaces -o go-template='
{{- range .items -}}
{{if .spec.externalIPs -}}
{{.metadata.namespace}}/{{.metadata.name}}: {{.spec.externalIPs}}{{"\n"}}
{{- end}}
{{- end -}}
'
You are encouraged to enable Kubernetes API server auditing to monitor your cluster for evidence of this vulnerability being exploited.
Monitor IBM Cloud Status for Future Security Bulletins
Monitor the security notifications on the IBM Cloud Status page to be advised of future security bulletins.
References
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
11 March 2021
UID
ibm16428017